1182587 - Set CORS allow-origin header for fetch from cdn

Status: RESOLVED FIXED

(Content Services Graveyard :: Tiles: Content Front-End, defect)

Description

[Ed Lee :Mardak]

For bug 1182449, we'll have an iframe hosted at https://tiles.cdn.mozilla.net/iframe.html that will be making XHR requests to https://tiles.services.mozilla.com/v3/links/fetch/en-US/hello

This should just be setting the header:

Access-Control-Allow-Origin: https://tiles.cdn.mozilla.net

It'll also be sending ping requests to https://tiles.services.mozilla.com/v3/links/{view|click} but the response body is empty, so it doesn't really matter that the UA blocks the response.

Comment 1

[Ed Lee :Mardak]

Both oyiptong and mostlygeek agree that this should be done at the app level instead of modifying nginx config.

Comment 2

[Olivier Yiptong [:oyiptong]]

We need to set the origin on both the onyx fetch endpoint and on the S3 bucket

Comment 3

[Olivier Yiptong [:oyiptong]]

mostlygeek suggests we set:

Access-Control-Allow-Origin: *

Comment 4

[Ed Lee :Mardak]

All parts are working with CORS per bug 1183778 comment 6